unit df;
{$O+}
interface

procedure df_enable;
procedure df_disable;

implementation
uses
  Hook, SySutils, NtFuncs;



var
  CurrProcess: Cardinal;
  defended: boolean;
  Nt, Zw: Phook;
  bts: Cardinal;

function NewZwTerminateProcess(ProcessHandle: Cardinal;     //kernel mode
     ExitStatus: Cardinal): Cardinal;      stdcall;
begin
  NewZwTerminateProcess := _EACCES_DENIED;
  if (ProcessHandle <> CurrProcess) then
  begin
    with Zw do
    begin
      WriteProcessMemory(CurrProcess, Addr, @Old, SizeOf(Old_Code), bts);  //disable hooking
      NewZwTerminateProcess := ZwTerminateProcess(ProcessHandle, ExitStatus);            //running Function
      WriteProcessMemory(CurrProcess, Addr, @jmp, SizeOf(far_jmp), bts);   //Enable Hooking
    end;
  end;
end;


function NewNtTerminateProcess(ProcessHandle: Cardinal; //analog of NewZwTerminateProcess for usermode
     ExitStatus: Cardinal): Cardinal;      stdcall;
begin
  NewNtTerminateProcess := _EACCES_DENIED;
  if (ProcessHandle <> CurrProcess) then
  begin
    with Nt do
    begin
      WriteProcessMemory(CurrProcess, Addr, @Old, SizeOf(Old_Code), bts);  //disable hooking
      NewNtTerminateProcess := NtTerminateProcess(ProcessHandle, ExitStatus);            //running Function
      WriteProcessMemory(CurrProcess, Addr, @jmp, SizeOf(far_jmp), bts);   //Enable Hooking
    end;
  end;
end;

function NewZwOpenProcess(var ProcessHandle: PHANDLE; DesiredAccess: Cardinal;
 ObjectAttributes: POBJECT_ATTRIBUTES; Cl_Id: Pointer): NTSTATUS; stdcall;
begin
  NewZwOpenProcess := _EACCES_DENIED;
  if (DesiredAccess = PROCESS_TERMINATE) then
  begin
    
  end;
end;

procedure df_enable;
begin
  Zw := Hook_Function('ntdll.dll', 'ZwTerminateProcess', @NewZwTerminateProcess);
  Nt := Hook_Function('ntdll.dll', 'NtTerminateProcess', @NewNtTerminateProcess);
end;

procedure df_disable;
begin
  Unhook_Function(zw);
  Unhook_Function(nt);
end;

initialization
  defended := false;
  CurrProcess := GetCurrentProcess;
finalization
  if defended then df_disable;
end.
